ReviewAI

An AI-powered code review CLI tool that combines static analysis with AI-powered reasoning to detect bugs, security vulnerabilities, performance issues, and maintainability problems.

Features

• 🤖 AI-Powered Analysis: Uses Google Gemini to understand code context and detect issues
• 🔍 Static Analysis: Detects common issues without external dependencies
• 🛡️ Security Focused: Identifies hardcoded credentials, SQL injection, and other vulnerabilities
• ⚡ Performance Analysis: Detects N+1 queries, synchronous I/O, and inefficient patterns
• 📊 Multiple Output Formats: Terminal, JSON, and SARIF for CI/CD integration
• ⚙️ Configurable: Support for .reviewai.json, environment variables, and CLI flags
• 🌍 Multi-Language: Python, JavaScript, and TypeScript support

Installation

Global Install

npm install -g reviewai

Then use from anywhere:

reviewai review ./src

Local Development

git clone <repo>
cd reviewai
npm install
npm run build
npm run dev -- review ./examples

Quick Start

1. Initialize Configuration

reviewai init

This creates .reviewai.json and .reviewaiignore.

2. Set API Key

export GEMINI_API_KEY=your-api-key-here

3. Run a Review

reviewai review ./src

Commands

reviewai review [path]

Review code for issues.

# Review a directory
reviewai review ./src

# Review a single file
reviewai review src/app.ts

# Review current project
reviewai review .

Options

• --language <lang>: Specify language (python, javascript, typescript, auto)
• --severity <level>: Minimum severity (critical, high, medium, low, info)
• --format <format>: Output format (terminal, json, sarif)
• --security: Report only security issues
• --performance: Report only performance issues
• --explain: Provide detailed explanations
• --no-ai: Disable AI analysis
• --verbose: Show debug information

Examples

# High severity only
reviewai review ./src --severity high

# JSON output for CI/CD
reviewai review . --format json

# Security-focused review
reviewai review . --security

# With detailed output
reviewai review . --format json > review.json

reviewai init

Initialize ReviewAI configuration in current project.

reviewai init

Creates:

• .reviewai.json - Configuration file
• .reviewaiignore - Ignore patterns

reviewai config

Show current configuration.

reviewai config

reviewai version

Show version information.

reviewai version

Configuration

.reviewai.json

{
  "language": "auto",
  "severity": "info",
  "outputFormat": "terminal",
  "ai": {
    "enabled": true,
    "provider": "gemini",
    "sendCode": true,
    "model": "gemini-2.0-flash",
    "apiKey": "sk-..."
  },
  "rules": {
    "security": true,
    "performance": true,
    "maintainability": true,
    "style": true,
    "bug": true
  },
  "ignorePatterns": [
    "node_modules",
    ".git",
    "dist"
  ],
  "verbose": false,
  "explain": false
}

Environment Variables

• GEMINI_API_KEY: Google Gemini API key (required for AI analysis)
• REVIEWAI_AI_ENABLED: Enable/disable AI analysis
• REVIEWAI_LANGUAGE: Default language
• REVIEWAI_SEVERITY: Default severity filter

.reviewaiignore

Ignore patterns (similar to .gitignore):

node_modules
.git
dist
build
coverage
.venv
__pycache__
.env

Configuration Precedence

Configuration is merged with this priority:

1. CLI arguments (highest)
2. .reviewai.json
3. Environment variables
4. Defaults (lowest)

Supported Languages

Python

• File extensions: .py
• Static analysis for imports, functions, classes
• Pattern-based issue detection

JavaScript

• File extensions: .js, .jsx
• Babel parser for AST analysis
• Security and performance checks

TypeScript

• File extensions: .ts, .tsx
• Full TypeScript support
• Type-aware analysis

Output Formats

Terminal

Human-readable output with colors and formatting:

✓ Completed: 24 files analyzed

Review Summary
────────────────────────────────────────

HIGH  security
src/auth.ts:42

Hardcoded credential detected.

Suggestion:
Move the credential into an environment variable.

JSON

Structured output for programmatic use:

{
  "summary": {
    "critical": 0,
    "high": 1,
    "medium": 2,
    "low": 1,
    "info": 3,
    "filesAnalyzed": 24,
    "totalIssues": 7
  },
  "files": [ ... ]
}

SARIF

Standard Analysis Results Format for CI/CD integration:

reviewai review . --format sarif > results.sarif

Compatible with:

• GitHub CodeQL
• GitLab Code Quality Reports
• Azure DevOps

AI Providers

Google Gemini (Default)

Uses Google's Gemini API for code analysis.

Setup:

1. Get API key from Google AI Studio
2. Set environment variable:

   export GEMINI_API_KEY=your-key

Configuration:

{
  "ai": {
    "provider": "gemini",
    "model": "gemini-2.0-flash",
    "apiKey": "your-key"
  }
}

Static Analysis

ReviewAI performs static analysis without AI:

Security Checks

• Hardcoded credentials
• SQL injection patterns
• eval() usage
• Weak random generators

Performance Checks

• Database queries in loops (N+1)
• Object creation in loops
• Synchronous I/O operations

Maintainability Checks

• Code complexity/nesting
• Line length
• TODO/FIXME comments

Style Checks

• Inconsistent indentation
• Trailing whitespace
• Multiple statements per line

CI/CD Integration

GitHub Actions

- name: ReviewAI
  run: |
    npm install -g reviewai
    reviewai review . --format json > review.json
  env:
    GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}

GitLab CI

review:
  script:
    - npm install -g reviewai
    - reviewai review . --format sarif > results.sarif
  artifacts:
    reports:
      sarif: results.sarif

Security & Privacy

⚠️ Important Security Considerations:

• Source Code: ReviewAI can send your source code to Google Gemini API for analysis. This is configurable via ai.sendCode in configuration.
• Secrets: By default, ReviewAI ignores .env files and common credential patterns.
• API Keys: Never hardcode API keys. Always use environment variables or secure configuration management.
• Network: Code is transmitted over HTTPS to Google's API servers.

Recommendations:

1. Review what gets sent: reviewai review . --verbose
2. Disable AI analysis for sensitive projects: --no-ai
3. Use .reviewaiignore to exclude sensitive files
4. Audit configuration: reviewai config

Exit Codes

• 0: Review completed with no blocking issues
• 1: Review found critical or high severity issues
• 2: CLI or configuration error
• 3: AI provider error

Configure exit behavior in CI/CD pipeline.

Development

Project Structure

reviewai/
├── src/
│   ├── cli/              # Command-line interface
│   │   └── commands/     # Individual commands
│   ├── core/             # Core logic
│   ├── analyzers/        # Static analysis
│   ├── languages/        # Language adapters
│   ├── ai/               # AI provider abstraction
│   ├── reporters/        # Output formatters
│   ├── config/           # Configuration
│   └── types/            # TypeScript types
├── tests/                # Tests and fixtures
└── dist/                 # Compiled output

Building

npm run build        # Compile TypeScript
npm run typecheck    # Type checking
npm run lint        # Linting
npm test            # Run tests

Testing

npm test                    # Run all tests
npm run test -- --ui        # Interactive test UI
npm run test -- src/cli     # Test specific module

Roadmap

Phase 1 (Current)

• ✅ CLI core
• ✅ File discovery
• ✅ Language detection
• ✅ Static analysis
• ✅ Terminal output
• ✅ Gemini integration

Phase 2

• AST analysis enhancements
• More language support
• Performance optimizations

Phase 3

• Caching and incremental analysis
• Custom rule definitions
• LSP support

Phase 4

• GUI dashboard
• History tracking
• Trend analysis

Contributing

Contributions welcome! Areas for improvement:

1. Additional language support
2. Custom rule definitions
3. Performance optimizations
4. UI improvements
5. Documentation

License

MIT

Support

• GitHub Issues: Report bugs and request features
• Documentation: Check README and code comments
• Examples: See tests/fixtures/ for sample code

Acknowledgments

Built as an implementation of AI-powered code review research combining:

• Static analysis
• AST-based analysis
• AI reasoning
• Actionable recommendations

Disclaimer

ReviewAI is a tool to assist developers in code review. It is not a replacement for human review. Always verify findings and use your professional judgment.